diff options
Diffstat (limited to 'tnet')
52 files changed, 575 insertions, 135 deletions
diff --git a/tnet/README.md b/tnet/README.md new file mode 100644 index 0000000..d65106e --- /dev/null +++ b/tnet/README.md @@ -0,0 +1,8 @@ +Generating link-local ULA address: + + echo fe80:$(uuid -v4|cut -c1-4):$(uuid -v4|cut -c1-4):$(uuid -v4|cut -c1-4):$(uuid -v4|cut -c1-4):$(uuid -v4|cut -c1-4):$(uuid -v4|cut -c1-4):$(uuid -v4|cut -c1-4) + +Generating Wireguard link keys: + + from=conflatorio to=knot; wg genkey | tee keys/wg-$from-$to.sops.key | wg pubkey > keys/wg-$from-$to.pub; sops -e -i keys/wg-$from-$to.sops.key + diff --git a/tnet/bird-deploy.yml b/tnet/bird-deploy.yml index ed7cecf..9759c01 100644 --- a/tnet/bird-deploy.yml +++ b/tnet/bird-deploy.yml @@ -1,9 +1,9 @@ - hosts: tnet_bird tasks: - become: yes - copy: - dest: "/etc/bird/{{ item }}" + template: src: "{{ inventory_hostname }}/{{ item }}" + dest: "/etc/bird/{{ item }}" owner: bird group: bird mode: 0640 @@ -23,4 +23,3 @@ systemd: name: bird state: reloaded - diff --git a/tnet/bird-gen-password.yml b/tnet/bird-gen-password.yml new file mode 100644 index 0000000..501c5ef --- /dev/null +++ b/tnet/bird-gen-password.yml @@ -0,0 +1 @@ +- tasks: diff --git a/tnet/bird-gen.yml b/tnet/bird-gen.yml index 9fa71b1..74a83b1 100644 --- a/tnet/bird-gen.yml +++ b/tnet/bird-gen.yml @@ -1,25 +1,16 @@ -- name: Remove old configuration - hosts: localhost - connection: local - gather_facts: False - tasks: - - file: - path: files - state: absent - changed_when: False - - name: Generate Bird configuration hosts: tnet_bird connection: local gather_facts: False tasks: - - file: + - name: rmdir files/$hostname + file: path: files/{{ inventory_hostname }} - state: directory + state: absent changed_when: False - template: src: "{{ item }}.j2" - dest: "files/{{ inventory_hostname }}/{{ item }}" + dest: "templates/{{ inventory_hostname }}/{{ item }}" loop: - bird-tnet-pre.conf - bird-tnet.conf diff --git a/tnet/files/lhn2pi/bird-tnet-pre.conf b/tnet/files/lhn2pi/bird-tnet-pre.conf deleted file mode 100644 index 383c050..0000000 --- a/tnet/files/lhn2pi/bird-tnet-pre.conf +++ /dev/null @@ -1,21 +0,0 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; - -function is_tnet() # -> bool -{ - return net ~ tnet && (net !~ tnet_router); -} - -roa6 table dn42_roa; - -protocol static { - roa6 { table dn42_roa; }; - include "/etc/bird/dn42_roa_bird2_6.conf"; -}; - -function dn42_is_valid_network() # -> bool -{ - return net ~ [ - fd00::/8{44,64} # ULA address space as per RFC 4193 - ]; -} diff --git a/tnet/files/node1/bird-tnet-pre.conf b/tnet/files/node1/bird-tnet-pre.conf deleted file mode 100644 index 383c050..0000000 --- a/tnet/files/node1/bird-tnet-pre.conf +++ /dev/null @@ -1,21 +0,0 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; - -function is_tnet() # -> bool -{ - return net ~ tnet && (net !~ tnet_router); -} - -roa6 table dn42_roa; - -protocol static { - roa6 { table dn42_roa; }; - include "/etc/bird/dn42_roa_bird2_6.conf"; -}; - -function dn42_is_valid_network() # -> bool -{ - return net ~ [ - fd00::/8{44,64} # ULA address space as per RFC 4193 - ]; -} diff --git a/tnet/files/node2/bird-tnet-pre.conf b/tnet/files/node2/bird-tnet-pre.conf deleted file mode 100644 index 383c050..0000000 --- a/tnet/files/node2/bird-tnet-pre.conf +++ /dev/null @@ -1,21 +0,0 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; - -function is_tnet() # -> bool -{ - return net ~ tnet && (net !~ tnet_router); -} - -roa6 table dn42_roa; - -protocol static { - roa6 { table dn42_roa; }; - include "/etc/bird/dn42_roa_bird2_6.conf"; -}; - -function dn42_is_valid_network() # -> bool -{ - return net ~ [ - fd00::/8{44,64} # ULA address space as per RFC 4193 - ]; -} diff --git a/tnet/group_vars/all/bird.sops.yml b/tnet/group_vars/all/bird.sops.yml new file mode 100644 index 0000000..334634f --- /dev/null +++ b/tnet/group_vars/all/bird.sops.yml @@ -0,0 +1,46 @@ +bgp_password: + conflatorio-knot: ENC[AES256_GCM,data:PBE4TnHXDw==,iv:Kj6SnVvwsYUrKt0Vqd76j6IaxufLP0Rf+Bw3i1M/3tI=,tag:9jPWHiqqTHSG8BMQ/k4pEw==,type:str] + coregonus-knot: ENC[AES256_GCM,data:WgO2B0FQVQ==,iv:zhaCbX6M7fMMHr63KgIrOcpnI9dmPJLTOlXJVqYkFb0=,tag:Y2H+RjuPGBMUFJJFEeL5Yw==,type:str] + hash-knot: ENC[AES256_GCM,data:SI2yYLIepg==,iv:Icky8rMsLQj77zu5vdqCZBWoHiYlNbIwlAvD5m+DH7A=,tag:9PImx9SXYuusNhZeWVPV7g==,type:str] + knot-kv24ix: ENC[AES256_GCM,data:z7SG+zuQ7g==,iv:APPjOs+MH9c0xfxmGEMoAQq00i847jGdbpoSkgwbpY0=,tag:jkgb7PlAF/kb50+i+3WEGw==,type:str] + knot-lhn2pi: ENC[AES256_GCM,data:k/pQyjnQyA==,iv:oW9t8Pruu/k/qIG6uG8Ex61QHerYhU09Ns0AI8NKkJA=,tag:H0A4jr/hBcGTuKeNV2zB1Q==,type:str] + knot-node1: ENC[AES256_GCM,data:rY0x5yu9zw==,iv:TyyhW1IwtkcU2q2y6ACgEqNEqMJ64PyMQ/kkkyCJB8E=,tag:fepqIEhEbrNFUr9f1iOMAQ==,type:str] + knot-node2: ENC[AES256_GCM,data:EE/JkIj23g==,iv:Gv1kd+lOFPir3z0TTlRdeOMffCQreBA5HiCHHwOUu+M=,tag:hwmABQCkbvQ6kSVchUZ6+g==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxb2RRcHh2UVN0U0ljeFgr + VndTMkRRR0Fzd042R0F5RnZpelZRNmVIcG1jCklHMkFoVjBhb3NrMjB5c3dMcjYv + Zkw5c3hIeElQOW54WDJ6a1MySDc2bGMKLS0tIEt3TTdLVkx4UFRCOU5WcWxjbXky + b05uMC94dUtxWE1qWHRTbVlubWQ4N1UKcPsMrAWryuaHar6qF/JL40hMkhkGoVsv + fj1FGz2xoI1FOtnqU8/LCOZF7ncUjzJS0m2GxiA/WDRLeLSWAi84vg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6MEJWVjF4cm04UU44bU9N + VEpmVnVDN1VIcm5RVk1VcThqNjFQQ3EzNkdjCnFGcVBMb0NiTzFSUm1qckkzRjNR + WEo1ai95L1B2bEpCYnB2blNyOFBwR0kKLS0tIFEyWlRZbUZWdnR0dzVCc0NraHpj + OUxUbWp4T1E2TTBTN0NRSDdKaXlJd2cKMwUjax16RyxnQRpxtZDjnrJx7CX06Z37 + T5GfLprSS4vXGfQkuJTDn7a/v8DfftOBL9ubclIet9cOD8YzIcAiZw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZEdhUlBEV1FBeGhSNVNG + YkQ1dmlieWlVMmMvUERNTnJlcVpmV3lBa0JjCnBJUWJmUmp2d01ZdFRlR3M1ZUI0 + NHhnMmxYNmlHeFFGbjJnK0w4QU5HenMKLS0tIHd6aUk1NWR2SnFCMENzSGFES0hi + VzVzNmtJampuZ2tKQnU3Y3FTZFFhdkUKej0Hy9kOYDqg+8B+slMdGE2Krcvqr4uJ + X7GxDCdLV7sllK6OlHe2aQkXb16oT0iGG7N61LCzWBDOfx0hzdyFPA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-10-19T18:22:33Z" + mac: ENC[AES256_GCM,data:Gm09oBu15JksqrK3H1TabhshiOShqwZLYFon6aqd8MmNQU0ufItZARU2K32Gu09dmDerE5Kbrq5u5U4fJXDkFRVYcFktIlD5FcCN2DlG7pB9rbpMZEHUt89wMAX6uvFat+66PUbE56Cio3Hlv88sB98VIKSratK2E0mlFB0oqYY=,iv:QaG4djyDGv+bpSz3+q6BTWAZyuUtNSkdG79/HciQlVE=,tag:TZ/qUmvWadnHYW/B00oEmQ==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.1 diff --git a/tnet/host_vars/conflatorio/bird.yml b/tnet/host_vars/conflatorio/bird.yml new file mode 100644 index 0000000..a976306 --- /dev/null +++ b/tnet/host_vars/conflatorio/bird.yml @@ -0,0 +1,5 @@ +tnet_bird_peers: + hash: + knot: + +birdv: 2015 diff --git a/tnet/host_vars/conflatorio/wg.yml b/tnet/host_vars/conflatorio/wg.yml new file mode 100644 index 0000000..087441b --- /dev/null +++ b/tnet/host_vars/conflatorio/wg.yml @@ -0,0 +1,7 @@ +tnet_wg: + knot: + endpoint: knot.inamo.no:51010 + address: fe80:47fc:660:b91f:1063:a6ae:46bb:7588 + hash: + endpoint: hash.trygvis.io:51007 + address: fe80:4540:476c:d432:2f32:818b:811b:bb60 diff --git a/tnet/host_vars/coregonus/bird.yml b/tnet/host_vars/coregonus/bird.yml new file mode 100644 index 0000000..816b95a --- /dev/null +++ b/tnet/host_vars/coregonus/bird.yml @@ -0,0 +1,4 @@ +tnet_bird_peers: + knot: + +birdv: 2015 diff --git a/tnet/host_vars/coregonus/wg.yml b/tnet/host_vars/coregonus/wg.yml new file mode 100644 index 0000000..0d80a18 --- /dev/null +++ b/tnet/host_vars/coregonus/wg.yml @@ -0,0 +1,5 @@ +tnet_wg: + knot: + endpoint: knot.inamo.no:51011 + address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3 + diff --git a/tnet/host_vars/hash/bird.yml b/tnet/host_vars/hash/bird.yml index 17cb4cd..2b4bb51 100644 --- a/tnet/host_vars/hash/bird.yml +++ b/tnet/host_vars/hash/bird.yml @@ -1,8 +1,11 @@ tnet_bird_peers: - astyanax: + conflatorio: rr_client: true + interface: tnet-confltrio knot: rr_client: true + lhn2pi: + rr_client: true node1: rr_client: true node2: diff --git a/tnet/host_vars/hash/wg.yml b/tnet/host_vars/hash/wg.yml index c7d9363..5754f57 100644 --- a/tnet/host_vars/hash/wg.yml +++ b/tnet/host_vars/hash/wg.yml @@ -19,3 +19,7 @@ tnet_wg: node2: port: 51006 address: fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8c + conflatorio: + if_name: confltrio + port: 51007 + address: fe80:4540:476c:d432:2f32:818b:811b:bb61 diff --git a/tnet/host_vars/knot/bird.yml b/tnet/host_vars/knot/bird.yml index 12dffeb..94c610a 100644 --- a/tnet/host_vars/knot/bird.yml +++ b/tnet/host_vars/knot/bird.yml @@ -1,6 +1,13 @@ tnet_bird_peers: + conflatorio: + rr_client: true + interface: tnet-confltrio + coregonus: + rr_client: true hash: rr_client: true + kv24ix: + rr_client: true node1: rr_client: true node2: @@ -12,3 +19,5 @@ tnet_bird_peers: as: 4242420207 address: fe80::207 interface: tnet-rtdbts_l1 + +birdv: 2015 diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml index e6c950a..9ad867e 100644 --- a/tnet/host_vars/knot/wg.yml +++ b/tnet/host_vars/knot/wg.yml @@ -9,14 +9,13 @@ tnet_wg: address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a kv24ix: port: 51003 - address: fdb1:4242:3538:ffff:ea4:11cb:863:5252 + address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7ce akili: port: 51004 address: fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a lhn2pi: port: 51005 - #address: fe80:440a:607e:b685:c955:93ae:29f8:dcd8 - address: fdb1:4242:3538:ffff:374e:2c7d:319e:e526 + address: fe80:d83a:350b:2162:6eda:1cc1:9cd7:80e8 astyanax: port: 51006 address: fe80:6728:53fc:fc81:40b3:9beb:8336:ba56 @@ -30,3 +29,11 @@ tnet_wg: port: 51009 address: fe80::621b:7ccf:ff44:c42c endpoint: router.lon1.routedbits.com:53538 + conflatorio: + if_name: confltrio + port: 51010 + address: fe80:47fc:0660:b91f:1063:a6ae:46bb:7589 + coregonus: + if_name: coregonus + port: 51011 + address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2 diff --git a/tnet/host_vars/kv24ix/wg.yml b/tnet/host_vars/kv24ix/wg.yml index 9cfdc5d..99c54b6 100644 --- a/tnet/host_vars/kv24ix/wg.yml +++ b/tnet/host_vars/kv24ix/wg.yml @@ -1,2 +1,3 @@ tnet_wg: knot: + address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf diff --git a/tnet/host_vars/lhn2pi/bird.yml b/tnet/host_vars/lhn2pi/bird.yml index b59526c..564c993 100644 --- a/tnet/host_vars/lhn2pi/bird.yml +++ b/tnet/host_vars/lhn2pi/bird.yml @@ -1,3 +1,5 @@ tnet_bird_peers: hash: knot: + +birdv: 2008 diff --git a/tnet/host_vars/lhn2pi/wg.yml b/tnet/host_vars/lhn2pi/wg.yml index f9e741f..c94745c 100644 --- a/tnet/host_vars/lhn2pi/wg.yml +++ b/tnet/host_vars/lhn2pi/wg.yml @@ -1,8 +1,7 @@ tnet_wg: knot: endpoint: knot.inamo.no:51005 - #address: fe80:440a:607e:b685:c955:93ae:29f8:dcd9 - address: fdb1:4242:3538:ffff:374e:2c7d:319e:e527 + address: fe80:d83a:350b:2162:6eda:1cc1:9cd7:80e9 hash: endpoint: hash.trygvis.io:51003 address: fe80:6195:1d43:9655:35f7:9dba:798c:26b9 diff --git a/tnet/keys/wg-conflatorio-hash.pub b/tnet/keys/wg-conflatorio-hash.pub new file mode 100644 index 0000000..8a27ee5 --- /dev/null +++ b/tnet/keys/wg-conflatorio-hash.pub @@ -0,0 +1 @@ +9o91CH8mx6OhTYer+gTMzwEfp94O4dSEOFuEKy/B+Ew= diff --git a/tnet/keys/wg-conflatorio-hash.sops.key b/tnet/keys/wg-conflatorio-hash.sops.key new file mode 100644 index 0000000..8c17e7c --- /dev/null +++ b/tnet/keys/wg-conflatorio-hash.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:4wFMiJhThT4ORoE/AdIRiN9EHr5NbSwysfhWCJxsLN6o7W3cMPA15E6ABnzk,iv:ib383CRTa7gCsC+RYAaJYV6TN8WMAPDJlQmlA2yUVow=,tag:LhhzRZGgYyviy7UTEeJbaQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMDhIREx3emlWdUgvQ0RW\nRnEvV0g4OWJkMmVSSHZaNzRLQTkvS1R0d1JnCk8xM0hMbWdEWlVhRklLeTNJYk9i\ncGtOL0huM29aU3dSNG92elJlV0k4ZncKLS0tIDVGcDBLbTI5Y1lUeFFJeGMrMm80\nQlFoTjRiVEh6UndoMHkvS3ptN3ZYc0EKfjcibzyYgYbZDTkz5g+FyxFFIFlU5LLL\nWGtyCal+2zl+h3z3vn4WUyHcj6BTqe3ks2zeyYWwiNuoTb1tSzj94Q==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzaFIwSDg0ZFNPZXdNOUxh\nSGdqYk1CaUpmVGg3YW1waTJFaUNtUHloTGtvClAxdmJnK1FLNStKdzBNTXo0TEpL\nbTZhcTVMR202QXBkV2VTcDJ6Z2Fqak0KLS0tIG9hb2M0b1NaRWMwaGl3UXZKWTU0\nN0lyM0dudDJsSm9HRzlxempMWEdlcncK4OG+Qrsn06Dl+wxk6SCg5dULZvZpDemE\n+MT6qbu74mgcS07PuzrCguueCC5mNBsjy8WanPQDRnzWqX+DzBxeDQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnMVp2SGdMTWFVd2U0MjVq\ndksvVFJvYUp3U2RyZHhOSERxNXZtSTBpSW5jClJWTkt0QmF1RU9hRExJb0wyNGxt\nK2ZzTnpOcU1BcElXT2wxd1o1R1VyTHcKLS0tIEJqOUVwY0h3VWxrc3F5aHluTHJJ\nckNlVzJJMHJkRXZPbER6ZXg5Z2xVa0kKByXn7yYIHY8Ckhr83tBYv062UDyBOYMS\nJ+dfYZ0ouT58l5CyatLURhyEDohAvQI95eKsIM1KkPgpzvV97Uq31Q==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-11T19:04:11Z", + "mac": "ENC[AES256_GCM,data:TroGIp1ZphoyDZXYxPbMpnCbq8i3v4eaT/8jlPnlFbCcHWqId2Tp2sBLlwuaq3E+vhvmN1K7ndbevCUhWmJW4oyWiEWXGUC3TUtVwc2nw3En/jsXFX9Yp7opF+a3iR+NLCbGTxm2CcQPoxuayAUIIp78ITB61SSF9QzIuAAhmcw=,iv:E3yB6yF3TDN8WPP+Kq78bK36Qw70Oz4Hl9lc7vhstnM=,tag:94udYmA1spcHcZMzylNA0w==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +}
\ No newline at end of file diff --git a/tnet/keys/wg-conflatorio-knot.pub b/tnet/keys/wg-conflatorio-knot.pub new file mode 100644 index 0000000..053a7d6 --- /dev/null +++ b/tnet/keys/wg-conflatorio-knot.pub @@ -0,0 +1 @@ +T6Gst6C4i8c1JDEdlWL4EMnkabEjUBfj9Ii6RiLU30c= diff --git a/tnet/keys/wg-conflatorio-knot.sops.key b/tnet/keys/wg-conflatorio-knot.sops.key new file mode 100644 index 0000000..973726d --- /dev/null +++ b/tnet/keys/wg-conflatorio-knot.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:X2V545B0R61+kZty3UEsBH83JytzpPCLMLpvgbct8+818EItkbhCiowJj01t,iv:ADEd0FZUSQPWuza8lL5Ld12j3nRfrewNxjMqwOfwA0Q=,tag:t/2Yg8XxOpCovgRn6zwztA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTTdzekJDdEhuKzhEUitG\nSU5qYVI3TURHTXUySk5Xenowc2FpczFDM3lJClI0L1huRVhGWjB3N0ZzQ2VoNEI1\nWVJtRCtJWmkyb0c5M2RVeS9IaytmU0EKLS0tIHdUNExJTGhqckVvSzhhTFFFTDhE\nQXY4NzlwM0FJbW41RFlRTXZIcnlBZ00KFN8m0pMUkNUoaUGTforKg4VMDL0qbs/J\nsPVXbJf9n+GTEn7qeqOvMDHW9hj5s8zQOyeNNt8k1PkmNjHbxNNolw==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RjNEdWQ5dnlzY2dubU5a\nTVN0ZFhOd2RrcGVrYjRKZzRBRVk5dHVSdDI4ClgyS1ZJUDVYQ2MzN2haWEZ4VTJj\nem5jYWdnYmpWMWhjREdBcHltTWV5YmsKLS0tIG5yVkt3em8weUVZTzY4N2JBOFo2\neUQ0M1JCL2RXTTlCc1RxakpjQzBXZDAKa+gNtS/eL3rdNp7Jl52EHcVfBzdVcezL\n8VawKcdVaFU8pXi2wSRjSJlVf4jESjTFC9dip3hAxM7R/V9M/SxXkg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdlNaM2RPYWZMMDh4V1Ew\nMkRIM2dTNktpYUxPWC9jcFFYeHcraTV1b2tvCk11RVZxMkdvd21ORWlXKzdrUm5w\nYUdZVTB2dmk3ZjFiaUlzdG54dmJpMDgKLS0tIDJwYWFGQmp2YXh6Z1BUMGdkWFNR\nemcwUHp1MjRobjh4ZEkyZjRzWDBFaGcK1EIKbWoR7dBHy/r0o2V9VxYaN9XJx5x4\n1fLZALfTA5C3kJgcuJbzhNUqvIwcKJ0LXpENidEHbAuZBTDzl0lYTQ==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-11T19:04:13Z", + "mac": "ENC[AES256_GCM,data:czGSSuK2RW0cIeJ4WRyu87EINudH8/tlwAxuALcTuvMWnzJ2B4kap9BAesCOw5FuZHzc4dGulmzrVbbH1pBg8REaWvy7989ELvNDFLyFqOc54XPfDuDMjT6D2SGw+2y6mB3kg0r1ajd3SASfhvc1q/8K1R2NZiO5xSG1ybbqlUM=,iv:VJVsV+xpL0gvXnlZjpZeljtqcJgLXl/+Rtkj0iBmBQ0=,tag:cqEbeEp4uc/vTjNaASnkDQ==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +}
\ No newline at end of file diff --git a/tnet/keys/wg-coregonus-knot.pub b/tnet/keys/wg-coregonus-knot.pub new file mode 100644 index 0000000..181fd56 --- /dev/null +++ b/tnet/keys/wg-coregonus-knot.pub @@ -0,0 +1 @@ +uOqXlYKRgwBXVKPAaPn2fx4YtMHCH5M2qQ3hs/tZwms= diff --git a/tnet/keys/wg-coregonus-knot.sops.key b/tnet/keys/wg-coregonus-knot.sops.key new file mode 100644 index 0000000..b3c6239 --- /dev/null +++ b/tnet/keys/wg-coregonus-knot.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:aPPYaRDzczKgMZxWKJXE5X7JC0pQxs9W0d3UZjY8QYLhxmxk8L+RpX6zWscR,iv:CE+JgwUMdkbFDrkk53ow77ehm3GEmeJFnVM5jbWXZIY=,tag:mlnV5SNhIOnU/+TnOWiU0g==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWml3V0dCRStJY0RsUEN5\nSVhya1dXYW5GQ0R1a1h3NVJMV09LbVV1eXhNCmFMS2JYVzVPbS95TmwxWG04emtO\nd3B5QUtxWGVaWTlpUDN4ZVErZ1BqcEEKLS0tIE9iTjJaN0RaZjJQeG5Zd1Z5Ylp1\nYkwxS0JqVzNLNHBkSjM0b2owcURZN1UKj5i3uMAwhcqM/vB6faF2vq3ndEYGEOAn\nH1m4LdRj0b03BOtz5vz5oeF+nW3e8rGwhq84N7UFdI4W+9w3ZCI2AQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVGdPaERQRWNodnpmOUFM\nWG1QSGhJUmoyamplMFFsK3krNzd4ZHVvdlY0Cit3UHNzNUVIVWlZakNsTUFNVlA1\neE9rNTliWmZ0a295UVJZUXo3dk9WTkkKLS0tIDE2SjE1bXFVdno5NkwwQk15UGZY\nczBPTTUwdTBJT0laWWJsWmJmNDFuUG8KRlCmMio144qdPuPXuxc2AEHhdUxbJT8W\nDp7Atk0G57V57tX/zk1RaXjp+ORStvwpgDAdCwmikt1PW78Y6x77tQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYWlHRUVTV1RreFExcDBj\nYmI3OTBpRnEwd0FBTDdPTHI1OVhRYmlZMGdFCjlHTWJPY0lSRVhPSTQyNEgxYkMy\nY3ljMnhKeURSL2JwcDd3dmlubW15bFEKLS0tIEZHUG9NUmNnUlh2NjlTd1RsYytR\nVDI0OVhZeGhyWFVFcU9URE1NRXpnR00KUO2W8ab2RehPhEAjFlOXWrr2rn55gBR5\neSvOtAPEEV1lWO+O0r3jOFpnUI/ahgPeBhMoLFOdionm3GPrYzf8aQ==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-20T22:51:59Z", + "mac": "ENC[AES256_GCM,data:4haVcOm18uCW8LK06wURyf32qr9ZXnjc6feJHf4T85C0COrmZ7AmxUZKt5Mi9YoPO7dTMpjcvnxhEVEP4x6/wBc3SB5RpRSWU25GZ4/ofnqR/xBH0R1edirQtuhsDJeR3rYnTYeMjRltf9zpZknED907GRmmddaO15xsWtU8/t8=,iv:wXMIQRj4mV7SNnUqC3XVM/8mEhbPMwL1Z4/LrIBqpcs=,tag:i6CSlmj2449GgMqosa8e0A==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +}
\ No newline at end of file diff --git a/tnet/keys/wg-hash-conflatorio.pub b/tnet/keys/wg-hash-conflatorio.pub new file mode 100644 index 0000000..bf16a1c --- /dev/null +++ b/tnet/keys/wg-hash-conflatorio.pub @@ -0,0 +1 @@ +oGEr7UWht1fUQ92hRu5r9SdRPfqj462behU34s6500o= diff --git a/tnet/keys/wg-hash-conflatorio.sops.key b/tnet/keys/wg-hash-conflatorio.sops.key new file mode 100644 index 0000000..c78eebc --- /dev/null +++ b/tnet/keys/wg-hash-conflatorio.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:LLC57pLBVZNEOTDdSEF4JgjGS8nLm/ef4ds71IFRJOX5tnnC9D/0hgbjdncF,iv:OU8/eGbM0axRajBOplvycs5rr100QPMv4RXYTv5NJMs=,tag:7IH46V36BbbhvCs5ze4UJQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEdjRCWlQ5OVI0cTkwL3Ey\nWG5tYUdNSks1UkpROU0wVUVVMlhwWEdweXpvCmFQYTE2bkZlV1BlZXg2d3pia0Jr\nVFhQVElXUjJCVGRXS2R4aEhBdzFBNU0KLS0tIEUzaHQxbzQ4aml0VHBaU0MyMjhJ\ncHo4L0doL1NKa0VOc21PanhhdUh2UGcKetAIpPpINd6UgrHYvTh/o5w4DlTlNY2c\n94zKEsWGShRZDOJ2EWiYR+47+OLTZjRKpt/oyXBhnyTa4gBSsNwHHg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCeTBwdU9iOGhaWThqOVN2\ndG1qUW43eW83NS9sQ0ExbnlIY0s3TlVQdlJJClJHeDloOTk2WFBPNitZQ3BXaFR0\nNVNCTncyV0RqVFJ4S2ZGWUt0RThHYWsKLS0tIDBxaVBXNjdlTXRsYlN5aWhnQkJ5\nd3pyS3preFRBWVF1eUE3eUYrZ2F6aDQKU447p1FB1bX98Ni3oQnhkRdM1al0ySvk\nSeApyf3gKO5BhtQkQKuMF2lRGQEJ8Vh4H0mxf8cTspCn4rld0T2P7w==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMjYwbHpkT0xWTDhzd3ZD\nRko0NXlZU1MwcmhCdGtCdFJ5SnAvVU1VK244CkY5VWRDVFhZUUdzMFpFR00vMlRv\nNmxUYjg2azcrRnBkQ09BVXlxeTYzRkkKLS0tIGljOTFnMll2RE1TWmpvMld2RWxu\nU2d0d2xwbWtZa3NoSUlXc3pnSHMraDQKYc02UngnR+mCVRKDxZy1VqiOW1AA9mEf\nf8XNX9CARGaAbXesOnj8ADKswErDOHrca4f1CbrgOWd9UM1qk6HyTw==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-11T19:04:03Z", + "mac": "ENC[AES256_GCM,data:ja8qprE1psQHAQ+hw8UDXxFqDg+K3tSBq+Hvef4z4nKd4+v8lhIBjCXTE7b+ovmFzJhV4jEd761ugHsxkLUcThAWkuaVy82dmF8idgKwTxg1NKmn3dBGC1fRjOXGPmOvO6Y6dCbL2L1e7z3EoQP2SzgcVa1/g+QgtnWEcTkvXKk=,iv:062sBg8V5nSq10VbFNZ3z7+FZLwXvKyXGbZEpdCjpM0=,tag:DM0zH1chw7pn8d9LwLh1Gg==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +}
\ No newline at end of file diff --git a/tnet/keys/wg-knot-conflatorio.pub b/tnet/keys/wg-knot-conflatorio.pub new file mode 100644 index 0000000..dfbd2b3 --- /dev/null +++ b/tnet/keys/wg-knot-conflatorio.pub @@ -0,0 +1 @@ +N3BmA8j6VuY7hmB/lWN3OjUK9cgNoMSOZiPiuSAytgQ= diff --git a/tnet/keys/wg-knot-conflatorio.sops.key b/tnet/keys/wg-knot-conflatorio.sops.key new file mode 100644 index 0000000..4565d73 --- /dev/null +++ b/tnet/keys/wg-knot-conflatorio.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:hDq6uKsf4/ZaLBtR+vW+ldTnupF0wGKYh1NwFuraHEs//9muJIcRwQ93Zhhd,iv:c/U1BRw2PdhWWFle7zYNOfjsvl7BYCbj2cKsc/vaHHI=,tag:pABhOJxuO7ARyfuCuqMwoA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb2ppbEY3SVZqL1pLM1h6\nWUJaZE5IQlRGUWlSNHBDeVpHSDBrT0Ztb1hzCjVOUEMyUm5JN1lBaTEvRlRHL1BT\nOTV0aGtXRnAvNWNNTWJiNGMwaU9CWncKLS0tIC9ySXdyOURsODRXODVNbkFyZlVm\nUXFwWFI4RzIrZUVUV1MvVlJyYTlCeDQKnZuwumgHUEwiAMtEEarlPEMAFYBQDGeD\n6oRPWB3lkVl4C7RAGjG/vkvgSf7Wq71Fv24YDRtJddYgnqWRTp+d9w==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNVStFYkUwNVVUUG9mRHFp\nazZValA1d08rcWlyeVdFTFBSVEJmUGFZQjNnCmtTQW5oeVNmWW4rR3liZjRJRDBi\nbEQ1VVFRajluSXUzcUtObm0ySUZYMjgKLS0tIHcweUVNendleGl5WlY1eVN0ZFFF\nRGs0enc1b2MxV2RBQnljdHR6N0dMTWsKKERcoegcxCLeAc07a/H5+jA9NopzyYfD\nlZ3tsursdaZKWsCRgPpQJfqtZVbin61zDrxgGJRpVsVkmGtqFZHfyQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkUThmR0xCOE9NN2xHTm9j\naGxpUVVQRXRTMzM5d2R4Mk84RkVScFdRZ3hZCk10TWtwZ09zWkl4TTU3ZDhDNWxp\nVEErYk5ucUpvNUordGdiRWsyS04zY1kKLS0tIEcwSTVZdU1HNFRVS2NTbjM3bGxB\ndGZreWNNWnFGd3JCM3VHeTJDZi83TzAK+y28heVBf2Tl+9X8sgKuAcyzrHn038RM\nzTFnhy0sn5FmmPeAt+DaTI5L23d4h9rs9kMuqkyWFvZH5L1ZKPMC6Q==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-11T19:04:05Z", + "mac": "ENC[AES256_GCM,data:Wo9zqglEVWtnfqK9X513PexmbrHEVbcgWSIfvdBAGVT4SAT26yvWVoPzBH1Nt11iePBwkLSjut5+G0Zf5XvhCnWwM3oGqGFhXAJqx3ta3mJIAFwD8E8DDEzvsVy5KM9AZkPv+YFSz33OgtrgSX/8sKfcVYO0DzivwTXiYKEeS1M=,iv:qTyug6kkZCF16oAL6uFsMsMG4aTh5nN8L4+Z0m844LE=,tag:JKXI0oi8D+X0PVVFMInoag==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +}
\ No newline at end of file diff --git a/tnet/keys/wg-knot-coregonus.pub b/tnet/keys/wg-knot-coregonus.pub new file mode 100644 index 0000000..7fc1905 --- /dev/null +++ b/tnet/keys/wg-knot-coregonus.pub @@ -0,0 +1 @@ +lTuzdN+En+Jc8v9+cTx2U455mw6v+fl/QsWWxO7ZYgI= diff --git a/tnet/keys/wg-knot-coregonus.sops.key b/tnet/keys/wg-knot-coregonus.sops.key new file mode 100644 index 0000000..6acb9ef --- /dev/null +++ b/tnet/keys/wg-knot-coregonus.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:NhASCvnUd1DDdo8qQ8MNY+KXMa9fACx7DNEwNwwLgjuwSu+bV42z/OYTY6Ck,iv:z0mGt+HuBwuS+WnbuomGwqReCXqEfIC+qPOuz+JciSw=,tag:sCUW0nXWJWgxYEAbkp+7JQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTWY3a0xxbzJnVm1GRHdU\nZU1IcnhKQkdEVjBtNFRIb0swWHlqdldFSUR3Ckg4dGlERkV4Ly93YVRwSjBJdzB0\nS1hmSkNQY2ROdDBZVTVmODRUR2Z4bmMKLS0tIFh0ZDJ1d2ViMFVwNlRkY3d6eU5E\nbHVhSXVCRWI2b2NKVVI1cGVjL3RGaVEKgFzmd42NmzH4GH4Vuklcd1jkCJnngloO\nN4Q5/NdHij8fXWnhkuV/8xX7KnBXEGX5uHo9pYd1aYzyZTUD40rDyw==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TmJ4UjZBN2pFU2dBZXdG\naDNtQUhGdkFnYkh5OXVlYTZ6c1N0YWpaTnpNCnZMWFgrWFpNd0tqVGpyN2NIZnlo\ncTRlQ1Q4UGJySm16TThwS0V1dW1nTlUKLS0tIGgzWjQvZ0hETW15TTV4S0Q1K1V5\naDFMODFVcVB4cmxnYXR5RTRnanQ0bVkKPZ/caVVhPQ/0I5X3A70czYnMNgw/l39W\nrf75d5RK5x5FcgZenz23l00g+AUt8uNfct+3YHc15OjL+vOrtm1NCQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjalBWcXg5NVlFS3Bjb0Vt\nUXlhNVNxMmtIMVhEdC8rb2h5UEJxUVpUckI0Ci9BaUM3YWJSczI1RVNQWGtIZllI\nQmhuK2dyMUwvRlpORUZDK2thWldUdFkKLS0tIDA2UVBzbTQ3aDEwcXNHcjRoMkNW\nRXhmZ3hmUlhVR0xzaWU1MDZBUW1zcTAKkkyLoqodk7FWwZV07wlkttEs115/v9ZI\nOVfi+VzkI++jLW2KzL1S1i1N+/BHnfXDnzNDaIqUTRrFi5jhd1kk0A==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-20T23:20:12Z", + "mac": "ENC[AES256_GCM,data:l4s7OdTHRqBXVGHpCQMo/k6nwwPEcWK8J47n1b8pQSDuO4DFcB/ApI8rNKgFAujXLUwB10YeRwp0bcLdlGREt7PhcHhddNB5yRYx/8djqYpm0w3rSAN9p4IW5CNB5LmfdxQk2dI0Ow8wxw8UzTVO08T7cDNeYRZdQTJLd+VUhCo=,iv:Ffv/pz30FwLaho3Y2HlMO11jKIl71GUpKMe1cSMNOwo=,tag:Qo3ZSTnJa26jYdwJtGvmyQ==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +}
\ No newline at end of file diff --git a/tnet/files/akili/bird-tnet-pre.conf b/tnet/templates/akili/bird-tnet-pre.conf index 383c050..74c981d 100644 --- a/tnet/files/akili/bird-tnet-pre.conf +++ b/tnet/templates/akili/bird-tnet-pre.conf @@ -1,9 +1,8 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; +define tnet = fdb1:4242:3538:2000::/52; -function is_tnet() # -> bool +function is_tnet() { - return net ~ tnet && (net !~ tnet_router); + return net ~ tnet; } roa6 table dn42_roa; @@ -13,7 +12,7 @@ protocol static { include "/etc/bird/dn42_roa_bird2_6.conf"; }; -function dn42_is_valid_network() # -> bool +function dn42_is_valid_network() { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 diff --git a/tnet/files/akili/bird-tnet.conf b/tnet/templates/akili/bird-tnet.conf index 24c9b8e..d306fcc 100644 --- a/tnet/files/akili/bird-tnet.conf +++ b/tnet/templates/akili/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -40,9 +38,11 @@ template bgp tnet_tpl { protocol bgp tnet_hash from tnet_tpl { neighbor fdb1:4242:3538:ffff:ca85:f812:3935:5fba; interface "tnet-hash"; + password "{{ bgp_password['akili-hash'] }}"; } protocol bgp tnet_knot from tnet_tpl { neighbor fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a; interface "tnet-knot"; + password "{{ bgp_password['akili-knot'] }}"; } diff --git a/tnet/files/hash/bird-tnet-pre.conf b/tnet/templates/astyanax/bird-tnet-pre.conf index 383c050..74c981d 100644 --- a/tnet/files/hash/bird-tnet-pre.conf +++ b/tnet/templates/astyanax/bird-tnet-pre.conf @@ -1,9 +1,8 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; +define tnet = fdb1:4242:3538:2000::/52; -function is_tnet() # -> bool +function is_tnet() { - return net ~ tnet && (net !~ tnet_router); + return net ~ tnet; } roa6 table dn42_roa; @@ -13,7 +12,7 @@ protocol static { include "/etc/bird/dn42_roa_bird2_6.conf"; }; -function dn42_is_valid_network() # -> bool +function dn42_is_valid_network() { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 diff --git a/tnet/files/astyanax/bird-tnet.conf b/tnet/templates/astyanax/bird-tnet.conf index 3dbf4c9..496cebe 100644 --- a/tnet/files/astyanax/bird-tnet.conf +++ b/tnet/templates/astyanax/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -40,9 +38,11 @@ template bgp tnet_tpl { protocol bgp tnet_hash from tnet_tpl { neighbor fe80:a0fd:89e4:42c6:f617:7398:abf4:b516; interface "tnet-hash"; + password "{{ bgp_password['astyanax-hash'] }}"; } protocol bgp tnet_knot from tnet_tpl { neighbor fe80:6728:53fc:fc81:40b3:9beb:8336:ba56; interface "tnet-knot"; + password "{{ bgp_password['astyanax-knot'] }}"; } diff --git a/tnet/templates/bird-tnet-pre.conf.j2 b/tnet/templates/bird-tnet-pre.conf.j2 index 383c050..e762cd5 100644 --- a/tnet/templates/bird-tnet-pre.conf.j2 +++ b/tnet/templates/bird-tnet-pre.conf.j2 @@ -1,9 +1,8 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; +define tnet = {{ ipam6.networks.tnet_dn42.range }}; -function is_tnet() # -> bool +function is_tnet(){{ " -> bool" if birdv >= 2015 }} { - return net ~ tnet && (net !~ tnet_router); + return net ~ tnet; } roa6 table dn42_roa; @@ -13,7 +12,7 @@ protocol static { include "/etc/bird/dn42_roa_bird2_6.conf"; }; -function dn42_is_valid_network() # -> bool +function dn42_is_valid_network(){{ " -> bool" if birdv >= 2015 }} { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 diff --git a/tnet/templates/bird-tnet.conf.j2 b/tnet/templates/bird-tnet.conf.j2 index 49e9410..1185014 100644 --- a/tnet/templates/bird-tnet.conf.j2 +++ b/tnet/templates/bird-tnet.conf.j2 @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -43,7 +41,17 @@ template bgp tnet_tpl { {% if policy == "tnet" %} protocol bgp tnet_{{ p }} from tnet_tpl { neighbor {{ hostvars[p].tnet_wg[inventory_hostname].address }}; +{% if peer.interface is defined %} + interface "{{ peer.interface }}"; +{% else %} interface "tnet-{{ p }}"; +{% endif %} +{% if inventory_hostname < p %} +{% set password_var = inventory_hostname + "-" + p %} +{% else %} +{% set password_var = p + "-" + inventory_hostname %} +{% endif %} + password "{{ "{{ bgp_password['" + password_var + "'] }}" }}"; {% if peer.rr_client|default(False) %} rr client; diff --git a/tnet/files/astyanax/bird-tnet-pre.conf b/tnet/templates/conflatorio/bird-tnet-pre.conf index 383c050..d60e8df 100644 --- a/tnet/files/astyanax/bird-tnet-pre.conf +++ b/tnet/templates/conflatorio/bird-tnet-pre.conf @@ -1,9 +1,8 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; +define tnet = fdb1:4242:3538:2000::/52; -function is_tnet() # -> bool +function is_tnet() -> bool { - return net ~ tnet && (net !~ tnet_router); + return net ~ tnet; } roa6 table dn42_roa; @@ -13,7 +12,7 @@ protocol static { include "/etc/bird/dn42_roa_bird2_6.conf"; }; -function dn42_is_valid_network() # -> bool +function dn42_is_valid_network() -> bool { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 diff --git a/tnet/templates/conflatorio/bird-tnet.conf b/tnet/templates/conflatorio/bird-tnet.conf new file mode 100644 index 0000000..4ffcc7f --- /dev/null +++ b/tnet/templates/conflatorio/bird-tnet.conf @@ -0,0 +1,48 @@ +# Set to true if this peer is directly connected to a dn42 peer +define is_dn42_peer = true; +# If we are connected directly to dn42, we don't want the dn42 routes from others +define import_dn42 = !is_dn42_peer; +define export_dn42 = is_dn42_peer; + +template bgp tnet_tpl { + local as 4242423538; + neighbor internal; + + direct; + + ipv6 { + next hop self; + import filter { + if is_tnet() then { + accept proto, ": (tnet) import accept, net=", net, ", from=", from, ", gw=", gw; + } else if import_dn42 && dn42_is_valid_network() then { + accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw; + } else { + reject proto, ": import reject, reason=not tnet"; + } + }; + # newer bird's only + # import keep filtered; + export filter { + if is_tnet() then { + accept proto, ": (tnet) export accept, net=", net, ", from=", from, ", gw=", gw; + } else if export_dn42 && dn42_is_valid_network() then { + accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw; + } else { + reject proto, ": export reject, reason=not tnet"; + } + }; + }; +} + +protocol bgp tnet_hash from tnet_tpl { + neighbor fe80:4540:476c:d432:2f32:818b:811b:bb61; + interface "tnet-hash"; + password "{{ bgp_password['conflatorio-hash'] }}"; +} + +protocol bgp tnet_knot from tnet_tpl { + neighbor fe80:47fc:0660:b91f:1063:a6ae:46bb:7589; + interface "tnet-knot"; + password "{{ bgp_password['conflatorio-knot'] }}"; +} diff --git a/tnet/files/knot/bird-tnet-pre.conf b/tnet/templates/coregonus/bird-tnet-pre.conf index 383c050..d60e8df 100644 --- a/tnet/files/knot/bird-tnet-pre.conf +++ b/tnet/templates/coregonus/bird-tnet-pre.conf @@ -1,9 +1,8 @@ -define tnet = fdb1:4242:3538::/48; -define tnet_router = fdb1:4242:3538:ffff::/64; +define tnet = fdb1:4242:3538:2000::/52; -function is_tnet() # -> bool +function is_tnet() -> bool { - return net ~ tnet && (net !~ tnet_router); + return net ~ tnet; } roa6 table dn42_roa; @@ -13,7 +12,7 @@ protocol static { include "/etc/bird/dn42_roa_bird2_6.conf"; }; -function dn42_is_valid_network() # -> bool +function dn42_is_valid_network() -> bool { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 diff --git a/tnet/templates/coregonus/bird-tnet.conf b/tnet/templates/coregonus/bird-tnet.conf new file mode 100644 index 0000000..2d2a573 --- /dev/null +++ b/tnet/templates/coregonus/bird-tnet.conf @@ -0,0 +1,42 @@ +# Set to true if this peer is directly connected to a dn42 peer +define is_dn42_peer = true; +# If we are connected directly to dn42, we don't want the dn42 routes from others +define import_dn42 = !is_dn42_peer; +define export_dn42 = is_dn42_peer; + +template bgp tnet_tpl { + local as 4242423538; + neighbor internal; + + direct; + + ipv6 { + next hop self; + import filter { + if is_tnet() then { + accept proto, ": (tnet) import accept, net=", net, ", from=", from, ", gw=", gw; + } else if import_dn42 && dn42_is_valid_network() then { + accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw; + } else { + reject proto, ": import reject, reason=not tnet"; + } + }; + # newer bird's only + # import keep filtered; + export filter { + if is_tnet() then { + accept proto, ": (tnet) export accept, net=", net, ", from=", from, ", gw=", gw; + } else if export_dn42 && dn42_is_valid_network() then { + accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw; + } else { + reject proto, ": export reject, reason=not tnet"; + } + }; + }; +} + +protocol bgp tnet_knot from tnet_tpl { + neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2; + interface "tnet-knot"; + password "{{ bgp_password['coregonus-knot'] }}"; +} diff --git a/tnet/templates/hash/bird-tnet-pre.conf b/tnet/templates/hash/bird-tnet-pre.conf new file mode 100644 index 0000000..74c981d --- /dev/null +++ b/tnet/templates/hash/bird-tnet-pre.conf @@ -0,0 +1,20 @@ +define tnet = fdb1:4242:3538:2000::/52; + +function is_tnet() +{ + return net ~ tnet; +} + +roa6 table dn42_roa; + +protocol static { + roa6 { table dn42_roa; }; + include "/etc/bird/dn42_roa_bird2_6.conf"; +}; + +function dn42_is_valid_network() +{ + return net ~ [ + fd00::/8{44,64} # ULA address space as per RFC 4193 + ]; +} diff --git a/tnet/files/hash/bird-tnet.conf b/tnet/templates/hash/bird-tnet.conf index b105201..d9c52b0 100644 --- a/tnet/files/hash/bird-tnet.conf +++ b/tnet/templates/hash/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -37,9 +35,10 @@ template bgp tnet_tpl { }; } -protocol bgp tnet_astyanax from tnet_tpl { - neighbor fe80:a0fd:89e4:42c6:f617:7398:abf4:b517; - interface "tnet-astyanax"; +protocol bgp tnet_conflatorio from tnet_tpl { + neighbor fe80:4540:476c:d432:2f32:818b:811b:bb60; + interface "tnet-confltrio"; + password "{{ bgp_password['conflatorio-hash'] }}"; rr client; } @@ -47,6 +46,15 @@ protocol bgp tnet_astyanax from tnet_tpl { protocol bgp tnet_knot from tnet_tpl { neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7c; interface "tnet-knot"; + password "{{ bgp_password['hash-knot'] }}"; + + rr client; +} + +protocol bgp tnet_lhn2pi from tnet_tpl { + neighbor fe80:6195:1d43:9655:35f7:9dba:798c:26b9; + interface "tnet-lhn2pi"; + password "{{ bgp_password['hash-lhn2pi'] }}"; rr client; } @@ -54,6 +62,7 @@ protocol bgp tnet_knot from tnet_tpl { protocol bgp tnet_node1 from tnet_tpl { neighbor fe80:a026:6ec2:b356:21c5:b51:22b9:a1df; interface "tnet-node1"; + password "{{ bgp_password['hash-node1'] }}"; rr client; } @@ -61,6 +70,7 @@ protocol bgp tnet_node1 from tnet_tpl { protocol bgp tnet_node2 from tnet_tpl { neighbor fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8d; interface "tnet-node2"; + password "{{ bgp_password['hash-node2'] }}"; rr client; } diff --git a/tnet/templates/knot/bird-tnet-pre.conf b/tnet/templates/knot/bird-tnet-pre.conf new file mode 100644 index 0000000..d60e8df --- /dev/null +++ b/tnet/templates/knot/bird-tnet-pre.conf @@ -0,0 +1,20 @@ +define tnet = fdb1:4242:3538:2000::/52; + +function is_tnet() -> bool +{ + return net ~ tnet; +} + +roa6 table dn42_roa; + +protocol static { + roa6 { table dn42_roa; }; + include "/etc/bird/dn42_roa_bird2_6.conf"; +}; + +function dn42_is_valid_network() -> bool +{ + return net ~ [ + fd00::/8{44,64} # ULA address space as per RFC 4193 + ]; +} diff --git a/tnet/files/knot/bird-tnet.conf b/tnet/templates/knot/bird-tnet.conf index 60c00ed..699c0f2 100644 --- a/tnet/files/knot/bird-tnet.conf +++ b/tnet/templates/knot/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -37,16 +35,42 @@ template bgp tnet_tpl { }; } +protocol bgp tnet_conflatorio from tnet_tpl { + neighbor fe80:47fc:660:b91f:1063:a6ae:46bb:7588; + interface "tnet-confltrio"; + password "{{ bgp_password['conflatorio-knot'] }}"; + + rr client; +} + +protocol bgp tnet_coregonus from tnet_tpl { + neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3; + interface "tnet-coregonus"; + password "{{ bgp_password['coregonus-knot'] }}"; + + rr client; +} + protocol bgp tnet_hash from tnet_tpl { neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7d; interface "tnet-hash"; + password "{{ bgp_password['hash-knot'] }}"; + + rr client; +} + +protocol bgp tnet_kv24ix from tnet_tpl { + neighbor fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf; + interface "tnet-kv24ix"; + password "{{ bgp_password['knot-kv24ix'] }}"; rr client; } protocol bgp tnet_lhn2pi from tnet_tpl { - neighbor fdb1:4242:3538:ffff:374e:2c7d:319e:e527; + neighbor fe80:d83a:350b:2162:6eda:1cc1:9cd7:80e9; interface "tnet-lhn2pi"; + password "{{ bgp_password['knot-lhn2pi'] }}"; rr client; } @@ -54,6 +78,7 @@ protocol bgp tnet_lhn2pi from tnet_tpl { protocol bgp tnet_node1 from tnet_tpl { neighbor fe80:58eb:3930:1815:2a6d:8918:70c9:96f3; interface "tnet-node1"; + password "{{ bgp_password['knot-node1'] }}"; rr client; } @@ -61,6 +86,7 @@ protocol bgp tnet_node1 from tnet_tpl { protocol bgp tnet_node2 from tnet_tpl { neighbor fe80:9dd8:abac:cf05:aea3:dc03:4c74:32db; interface "tnet-node2"; + password "{{ bgp_password['knot-node2'] }}"; rr client; } diff --git a/tnet/templates/lhn2pi/bird-tnet-pre.conf b/tnet/templates/lhn2pi/bird-tnet-pre.conf new file mode 100644 index 0000000..74c981d --- /dev/null +++ b/tnet/templates/lhn2pi/bird-tnet-pre.conf @@ -0,0 +1,20 @@ +define tnet = fdb1:4242:3538:2000::/52; + +function is_tnet() +{ + return net ~ tnet; +} + +roa6 table dn42_roa; + +protocol static { + roa6 { table dn42_roa; }; + include "/etc/bird/dn42_roa_bird2_6.conf"; +}; + +function dn42_is_valid_network() +{ + return net ~ [ + fd00::/8{44,64} # ULA address space as per RFC 4193 + ]; +} diff --git a/tnet/files/lhn2pi/bird-tnet.conf b/tnet/templates/lhn2pi/bird-tnet.conf index 895409c..f755c3b 100644 --- a/tnet/files/lhn2pi/bird-tnet.conf +++ b/tnet/templates/lhn2pi/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -40,9 +38,11 @@ template bgp tnet_tpl { protocol bgp tnet_hash from tnet_tpl { neighbor fe80:6195:1d43:9655:35f7:9dba:798c:26b8; interface "tnet-hash"; + password "{{ bgp_password['hash-lhn2pi'] }}"; } protocol bgp tnet_knot from tnet_tpl { - neighbor fdb1:4242:3538:ffff:374e:2c7d:319e:e526; + neighbor fe80:d83a:350b:2162:6eda:1cc1:9cd7:80e8; interface "tnet-knot"; + password "{{ bgp_password['knot-lhn2pi'] }}"; } diff --git a/tnet/templates/node1/bird-tnet-pre.conf b/tnet/templates/node1/bird-tnet-pre.conf new file mode 100644 index 0000000..74c981d --- /dev/null +++ b/tnet/templates/node1/bird-tnet-pre.conf @@ -0,0 +1,20 @@ +define tnet = fdb1:4242:3538:2000::/52; + +function is_tnet() +{ + return net ~ tnet; +} + +roa6 table dn42_roa; + +protocol static { + roa6 { table dn42_roa; }; + include "/etc/bird/dn42_roa_bird2_6.conf"; +}; + +function dn42_is_valid_network() +{ + return net ~ [ + fd00::/8{44,64} # ULA address space as per RFC 4193 + ]; +} diff --git a/tnet/files/node1/bird-tnet.conf b/tnet/templates/node1/bird-tnet.conf index 6449582..bafb6de 100644 --- a/tnet/files/node1/bird-tnet.conf +++ b/tnet/templates/node1/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -40,9 +38,11 @@ template bgp tnet_tpl { protocol bgp tnet_hash from tnet_tpl { neighbor fe80:a026:6ec2:b356:21c5:b51:22b9:a1de; interface "tnet-hash"; + password "{{ bgp_password['hash-node1'] }}"; } protocol bgp tnet_knot from tnet_tpl { neighbor fe80:58eb:3930:1815:2a6d:8918:70c9:96f2; interface "tnet-knot"; + password "{{ bgp_password['knot-node1'] }}"; } diff --git a/tnet/templates/node2/bird-tnet-pre.conf b/tnet/templates/node2/bird-tnet-pre.conf new file mode 100644 index 0000000..74c981d --- /dev/null +++ b/tnet/templates/node2/bird-tnet-pre.conf @@ -0,0 +1,20 @@ +define tnet = fdb1:4242:3538:2000::/52; + +function is_tnet() +{ + return net ~ tnet; +} + +roa6 table dn42_roa; + +protocol static { + roa6 { table dn42_roa; }; + include "/etc/bird/dn42_roa_bird2_6.conf"; +}; + +function dn42_is_valid_network() +{ + return net ~ [ + fd00::/8{44,64} # ULA address space as per RFC 4193 + ]; +} diff --git a/tnet/files/node2/bird-tnet.conf b/tnet/templates/node2/bird-tnet.conf index b9a2294..8a7b887 100644 --- a/tnet/files/node2/bird-tnet.conf +++ b/tnet/templates/node2/bird-tnet.conf @@ -10,8 +10,6 @@ template bgp tnet_tpl { direct; - password "trygvis"; - ipv6 { next hop self; import filter { @@ -40,9 +38,11 @@ template bgp tnet_tpl { protocol bgp tnet_hash from tnet_tpl { neighbor fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8c; interface "tnet-hash"; + password "{{ bgp_password['hash-node2'] }}"; } protocol bgp tnet_knot from tnet_tpl { neighbor fe80:9dd8:abac:cf05:aea3:dc03:4c74:32da; interface "tnet-knot"; + password "{{ bgp_password['knot-node2'] }}"; } diff --git a/tnet/wg-links-link.yml b/tnet/wg-links-link.yml index 6f1bb87..c1c520b 100644 --- a/tnet/wg-links-link.yml +++ b/tnet/wg-links-link.yml @@ -1,3 +1,12 @@ +- set_fact: + if_name: tnet-{{ item.value.if_name|default(item.key) }} + +#- debug: +# msg: | +# if_name {{ if_name }} +# item.value.if_name {{ item.value.if_name|default("NOT SET") }} +# item.key {{ item.key }} + - notify: systemctl restart systemd-networkd become: yes file: @@ -8,13 +17,13 @@ notify: systemctl restart systemd-networkd become: yes copy: - dest: "/etc/systemd/network/50-tnet-{{ item.key }}.netdev" + dest: "/etc/systemd/network/50-{{ if_name }}.netdev" owner: systemd-network group: adm mode: 0640 content: | [NetDev] - Name=tnet-{{ item.key }} + Name={{ if_name }} Kind=wireguard Description=tnet link to {{ item.key }} @@ -42,12 +51,12 @@ notify: systemctl restart systemd-networkd become: yes copy: - dest: "/etc/systemd/network/50-tnet-{{ item.key }}.network" + dest: "/etc/systemd/network/50-{{ if_name }}.network" owner: systemd-network group: adm content: | [Match] - Name=tnet-{{ item.key }} + Name={{ if_name }} [Network] Address={{ item.value.address }}/64 |